full-disclosure - Re: DLL hijacking with Autorun on a USB drive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTi==9z+ydmvb_3zNwC9OJS-oaUMJWNvotQNCDF8O@mail.gmail.com>
Date: Wed, 1 Sep 2010 14:47:25 -0500
From: matt <matt@...ackvector.org>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: DLL hijacking with Autorun on a USB drive

> And yeah, I find it a joke that you think that ".ppt.exe" isn't pretty

> damn obvious.

> I might have fell for that when I was 9, but I haven't had a problem
> with a windows box in years.

> I will admit, at 3AM when I've been working for 18 hours and awake for
> 36, it is possible that I may double-click
> such a malicious file and then immediately think "OH shit" and rebuild.

Thats the real threat of this, to be honest.  Yes, you, me, and
(hopefully) the rest of the people on this list know what to look for
before clicking on something.  But, > do you view a .doc, or .ppt, or
.mp3 as malicious and threatening as a .exe, .bat, or .vbs?  Probably
not.

And, you cannot honestly tell me that you've never browsed to a
network share and opened a Word document.  And, if that Word document
opens and there's legitimate data being displayed (ie - it's the
document that you were expecting to open), would you ever consider
that you just compromised your system?

I think that's what a lot of you are missing.. there's no real
trickery involved; No changing of icons, no hiding extensions, no fake
files.. a DLL could be dropped into any directory containing Office
documents and now each one of those Office documents are, essentially,
backdoored.  And, not only that, but this is affecting file formats
which were previously considered benign or harmless (for the most
part).

- matt

www.attackvector.org

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/